CVE-2017-1000422
published 2018-01-02CVE-2017-1000422: Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code…
PriorityP341high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
2.02%
78.5th percentile
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | gdk-pixbuf | < gdk-pixbuf 2.36.11-1 (bookworm) | gdk-pixbuf 2.36.11-1 (bookworm) |
| gnome | gdk-pixbuf | <= 2.36.8 | — |
| gnome | gdk-pixbuf | >= 0 < 2.36.11-1 | 2.36.11-1 |
| gnome | gdk-pixbuf | >= 0 < 2.36.11-1 | 2.36.11-1 |
| gnome | gdk-pixbuf | >= 0 < 2.36.11-1 | 2.36.11-1 |
| gnome | gdk-pixbuf | >= 0 < 2.36.11-1 | 2.36.11-1 |
| gnome | gdk-pixbuf | >= 0 < 2.30.7-0ubuntu1.8 | 2.30.7-0ubuntu1.8 |
| gnome | gdk-pixbuf | >= 0 < 2.32.2-1ubuntu1.4 | 2.32.2-1ubuntu1.4 |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-245r-96m5-w336: Gnome gdk-pixbuf 2
ghsa_unreviewed·2022-05-14
CVE-2017-1000422 [HIGH] CWE-190 GHSA-245r-96m5-w336: Gnome gdk-pixbuf 2
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
OSV
gdk-pixbuf vulnerabilities
osv·2018-01-15·CVSS 8.8
CVE-2017-1000422 [HIGH] gdk-pixbuf vulnerabilities
gdk-pixbuf vulnerabilities
It was discoreved that GDK-PixBuf incorrectly handled certain gif images.
An attacker could use this to execute arbitrary code. This issue only affected
Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-1000422)
Ariel Zelivansky discovered that GDK-PixBuf incorrectly handled certain images.
An attacker could use this to cause a denial of service.
(CVE-2017-6312, CVE-2017-6313)
Ariel Zelivansky discovered that GDK-PixBuf incorrectly handled large TIFF files.
An attacker could use this to cause a denial of service. (CVE-2017-6314)
OSV
CVE-2017-1000422: Gnome gdk-pixbuf 2
osv·2018-01-02·CVSS 8.8
CVE-2017-1000422 [HIGH] CVE-2017-1000422: Gnome gdk-pixbuf 2
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
Ubuntu
GDK-PixBuf vulnerabilities
vendor_ubuntu·2018-01-15·CVSS 8.8
CVE-2017-1000422 [HIGH] GDK-PixBuf vulnerabilities
Title: GDK-PixBuf vulnerabilities
Summary: Several security issues were fixed in GDK-PixBuf.
It was discoreved that GDK-PixBuf incorrectly handled certain gif images.
An attacker could use this to execute arbitrary code. This issue only affected
Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-1000422)
Ariel Zelivansky discovered that GDK-PixBuf incorrectly handled certain images.
An attacker could use this to cause a denial of service.
(CVE-2017-6312, CVE-2017-6313)
Ariel Zelivansky discovered that GDK-PixBuf incorrectly handled large TIFF files.
An attacker could use this to cause a denial of service. (CVE-2017-6314)
Instructions: After a standard system update you need to restart your session to make
all the necessary changes.
Red Hat
gdk-pixbuf: Integer overflow in io-gif.c:gif_get_lzw() can lead to memory corruption and potential code execution
vendor_redhat·2017-08-07·CVSS 8.8
CVE-2017-1000422 [HIGH] CWE-190 gdk-pixbuf: Integer overflow in io-gif.c:gif_get_lzw() can lead to memory corruption and potential code execution
gdk-pixbuf: Integer overflow in io-gif.c:gif_get_lzw() can lead to memory corruption and potential code execution
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
Package: gdk-pixbuf (Red Hat Enterprise Linux 5) - Not affected
Package: gdk-pixbuf2 (Red Hat Enterprise Linux 6) - Not affected
Package: gdk-pixbuf2 (Red Hat Enterprise Linux 7) - Not affected
Package: gdk-pixbuf2 (Red Hat Enterprise Linux 8) - Not affected
Debian
CVE-2017-1000422: gdk-pixbuf - Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in t...
vendor_debian·2017·CVSS 8.8
CVE-2017-1000422 [HIGH] CVE-2017-1000422: gdk-pixbuf - Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in t...
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
Scope: local
bookworm: resolved (fixed in 2.36.11-1)
bullseye: resolved (fixed in 2.36.11-1)
forky: resolved (fixed in 2.36.11-1)
sid: resolved (fixed in 2.36.11-1)
trixie: resolved (fixed in 2.36.11-1)
No detection rules found.
No public exploits indexed.
https://bugzilla.gnome.org/show_bug.cgi?id=785973https://lists.debian.org/debian-lts-announce/2018/01/msg00007.htmlhttps://security.gentoo.org/glsa/201804-14https://usn.ubuntu.com/3532-1/https://www.debian.org/security/2018/dsa-4088https://bugzilla.gnome.org/show_bug.cgi?id=785973https://lists.debian.org/debian-lts-announce/2018/01/msg00007.htmlhttps://security.gentoo.org/glsa/201804-14https://usn.ubuntu.com/3532-1/https://www.debian.org/security/2018/dsa-4088
2018-01-02
Published